MEDIUM5.3
GHSA-9986-w5h5-vw59
Directory traversal in Mort Bay Jetty
Quick fix
GHSA-9986-w5h5-vw59 — org.mortbay.jetty:jetty: upgrade to the fixed version with the command below.
# pom.xml: bump <version>6.1.17</version> for org.mortbay.jetty:jettyDetails
Directory traversal vulnerability in the HTTP server in Mort Bay Jetty 5.1.14, 6.x before 6.1.17, and 7.x through 7.0.0.M2 allows remote attackers to access arbitrary files via directory traversal sequences in the URI.
Are you affected?
Enter the version of the package you're using.
Affected packages
Maven/org.mortbay.jetty:jetty
Introduced in:
0Fixed in: 6.1.17Fix
# pom.xml: bump <version>6.1.17</version> for org.mortbay.jetty:jettyMaven/org.mortbay.jetty:jetty
Introduced in:
7.0.0.M0Fixed in: 7.0.0.M2Fix
# pom.xml: bump <version>7.0.0.M2</version> for org.mortbay.jetty:jettyReferences
- https://nvd.nist.gov/vuln/detail/CVE-2009-1523[ADVISORY]
- https://bugzilla.redhat.com/show_bug.cgi?id=499867[WEB]
- https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01257.html[WEB]
- https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01259.html[WEB]
- https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01262.html[WEB]
- http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02282388[WEB]
- http://jira.codehaus.org/browse/JETTY-1004[WEB]
- http://www.kb.cert.org/vuls/id/402580[WEB]
- http://www.kb.cert.org/vuls/id/CRDY-7RKQCY[WEB]
- http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html[WEB]
- http://www.securityfocus.com/bid/34800[WEB]
- http://www.securityfocus.com/bid/35675[WEB]
- http://www.securitytracker.com/id?1022563[WEB]
- http://www.vupen.com/english/advisories/2009/1900[WEB]
- http://www.vupen.com/english/advisories/2010/1792[WEB]